Consumer Health Data Privacy Policy
This policy is required by Washington’s My Health My Data Act. It applies to health data about people in Washington and explains what we collect, who receives it and your rights.
Health data we collect
- Your symptoms, the reason for your absence and when it started, and your answers to our safety questions.
- The dates of your absence and the state you are in.
- Forms or documents you upload, such as an airline or employer form.
- The physician’s decision and your note.
- Anything about your health you write to our support team.
- Your name, date of birth, email address and phone number, because they are linked to the information above.
Why we collect it and how we use it
- To evaluate your request and issue your note.
- To send you your note and updates about your order.
- To answer your questions and fix problems with your order.
- To keep your medical record for 10 years, as medical-records laws require.
- To prevent fraud and misuse.
Where it comes from
- You, through our order form, your uploads and your emails.
- The physician who reviews your request.
- An employer or school that contacts us to check a note. They see only what the verification page shows, never your health information.
Who receives it
We share the health data listed above only with these companies, which run parts of our service for us:
- SickSlip, Inc., our affiliate, which runs the technology and administration for SickSlip P.A.
- Database, file storage and sign-in: Supabase.
- Website and server hosting: Vercel and Render.
- Encrypted backups: Backblaze.
- Email: Google Workspace and Resend.
- Text messages about your order, without health details: Twilio.
- Artificial intelligence services that help us read forms and support emails: Anthropic.
- Error monitoring: Sentry. Product analytics, with what you type hidden: PostHog.
Payments are handled by Stripe, which receives no health information. We do not share health data from Washington customers with any advertising platform, and we do not report their purchases to one. We do not sell health data.
Your rights
- Confirm whether we collect, share or sell your health data, see it, and get a list of every third party and affiliate we shared it with, with contact details.
- Withdraw your consent to our collection and sharing of your health data.
- Have your health data deleted, including from the companies listed above. Where a law requires us to keep your medical record, we tell you which part and why.
- Be treated the same whether or not you use these rights.
How to use your rights
Email privacy@sickslip.co with the subject “Washington health data request”. We may ask you to confirm your identity. We answer within 45 days, and tell you if we need up to 45 more.
If we decline, reply with the subject “Appeal” and we answer within 45 days. If you disagree with the outcome, you can file a complaint with the Washington State Attorney General at atg.wa.gov/file-complaint.
More about your privacy
Our Privacy Policy covers everything else, including the rights of residents of other states.